up vote 1 down vote favorite
share [g+] share [fb]

Is it possible to force users (on Windows 7 PCs) to change their password once it has expired?

Currently our users get notifications that their passwords will expire in 7, 3, 2 and 1 days but once the password has expired they are still able to log into their machines with the expired password.

Most of our users ignore the warnings and don't change their password until we tell them they have to (when they ring Help Desk asking why their email and intranet isn't working).

From memory, Windows XP machines would show a message at login that the password had expired and then offer the change password screen. Is it possible to do the same thing under Win7? Similar to how if you set a user's account to "must change password at next login" it gives the change password screen automatically.

link|improve this question
67% accept rate
Are you running active directory? Its fairly easy to setup with AD. – Zac Garrett Oct 19 '10 at 1:24
Yes, on Server 2008 R2 – Windos Oct 19 '10 at 1:35
Any advice on how? AD currently handles out user accounts, passwords, password expiry, access to systems. But the machines themselves still allow users to log in with an expired password (if they have logged into it prior to it expiring - like... when it is the user's day to day machine). – Windos Nov 1 '10 at 20:58
If you don't mind my asking...what's the purpose of forcing them to change their passwords periodically? What scenario does this protect against? – Kyralessa Jan 12 '11 at 3:54
First and foremost, audit requirements. Second, and somewhat tied into the first point; it's a huge security hole if someone's password is leaked and if they are forced to be changed then a leaked password is only good for a max of 42 days. We're in a medium sized enterprise environment, fyi. – Windos Jan 12 '11 at 3:57
feedback

1 Answer

up vote 1 down vote accepted

We still haven't figured out how to force the user to change their password.

Since the main problem is users ignoring the little "Your password will expire in..." and "Your password has expired" bubbles, we have a script run on login that checks if the password has expired and blocks the screen (with instructions on how to change the password) if it is.

This has dramatically reduced the number of calls we get regarding not being able to access emails or intranet.

link|improve this answer
Windos, Would you happen to have a copy of the script you used? – John Dec 27 '11 at 19:22
@John, unfortuantly no. I wasn't the one to write it and the person who did is still on leave. – Windos Jan 9 at 3:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.